Privacy Notice

Flowstay operates the marketplace and hospitality management platform at flowstay.ng. For the purposes of the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act 2023, Flowstay is the data controller for personal data processed through the Platform.

We collect and process the following categories of data:

• Account data — name, email address, password (hashed), phone number, profile photo.
• Company data — company name, role, team membership, verification status.
• Verification (KYC) data — identity documents and selfies submitted for host/guest company verification.
• Booking data — stays, messages with hosts or guests, reviews, wishlists, recently viewed properties.
• Payout data — bank details required to settle host earnings, stored encrypted.
• Technical data — device/browser information, IP address, and usage logs needed to operate and secure the service.

We process personal data on the following bases: performance of a contract (operating bookings, payouts, and messaging you request); legitimate interests (platform security, fraud prevention, and service improvement); consent (marketing communications and optional cookies); and compliance with legal obligations (tax, accounting, and lawful requests from authorities).

We use personal data to create and manage accounts, facilitate bookings and payments, verify hosts and guest companies, power search and community features, provide customer support, prevent fraud and abuse, and comply with legal obligations. We do not sell your personal data.

Personal data is shared only as needed: identity/contact details with the host or guest on a booking; payment processors to complete transactions; cloud infrastructure providers under contract; professional advisers; and regulators or law enforcement where legally required. Verification documents are accessible only to authorized platform administrators.

Where data is transferred outside Nigeria, we rely on appropriate safeguards such as contractual clauses or equivalent protections with the receiving provider.

Account and booking records are retained while your account is active and for up to 6 years afterwards where required for tax, accounting, or dispute resolution. Verification documents are retained for the duration of verification plus any statutory period, then deleted. You can request earlier deletion where no legal obligation requires us to keep the data.

You have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion where retention is not legally required;
• object to or restrict certain processing;
• withdraw consent at any time (where processing is based on consent);
• request portability of data you provided to us.

To exercise these rights, contact [email protected]. We respond within the timelines required by the NDPR. You may also complain to the Nigeria Data Protection Commission (NDPC).

We apply technical and organizational measures including encryption in transit, encryption of sensitive payout data at rest, access controls, and audit logging. No system is perfectly secure; we encourage strong, unique passwords and prompt reporting of suspected incidents.

Our Data Protection Officer can be reached at [email protected].